Rate limiting protects a service from overload and from one noisy client. It answers allow or reject (often HTTP 429) per key, such as a client or tenant.